CVE-2026-15692: Tenda BE12 Pro Stack-Based Buffer Overflow Vulnerability

A critical stack-based buffer overflow vulnerability, tracked as CVE-2026-15692, has been discovered in the Tenda BE12 Pro wireless router, specifically in firmware version 16.03.66.23. The flaw resides within the fromSafeUrlFilter function of the /goform/SafeUrlFilter file. Attackers can remotely exploit this weakness by sending a specially crafted HTTP request that manipulates the page argument. This manipulation leads to a buffer overflow, which can be leveraged to achieve arbitrary code execution on the device. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) and is particularly concerning as an exploit has been made publicly available, increasing the likelihood of widespread exploitation. This vulnerability affects the device's core functionality, enabling potential compromise of network infrastructure.

Attack Chain

1. An attacker, with network access to the Tenda BE12 Pro device, identifies the vulnerable /goform/SafeUrlFilter endpoint.
2. The attacker crafts an HTTP POST request targeting this endpoint.
3. The request includes a page argument within the cs-uri-query that is malformed or excessively long, designed to exceed the buffer allocated for it in the fromSafeUrlFilter function.
4. The vulnerable fromSafeUrlFilter function attempts to process the manipulated page argument, triggering a stack-based buffer overflow.
5. The overflow overwrites adjacent memory regions on the stack, allowing the attacker to inject and execute arbitrary code.
6. Upon successful exploitation, the attacker gains remote code execution capabilities on the Tenda BE12 Pro router.
7. This RCE can lead to full compromise of the device, allowing the attacker to establish persistence, exfiltrate data, or pivot to other systems on the internal network.

Impact

Successful exploitation of CVE-2026-15692 grants remote attackers arbitrary code execution on the Tenda BE12 Pro router. This can lead to a complete compromise of the affected device, resulting in a loss of confidentiality, integrity, and availability of the network traffic passing through the router. Attackers could redirect traffic, steal sensitive information, use the router as a foothold for further attacks on the internal network, or disrupt internet access for connected users. As a critical network device, its compromise can severely impact business operations and data security. The public availability of exploit details increases the risk of targeted and widespread attacks.

Recommendation

• Immediately update Tenda BE12 Pro devices to a patched firmware version when available to remediate CVE-2026-15692.
• Deploy the provided Sigma rule to your SIEM to detect attempts to exploit CVE-2026-15692 by monitoring webserver logs for suspicious cs-uri-query patterns on /goform/SafeUrlFilter.
• Implement network segmentation to isolate critical systems and reduce the potential impact of compromised edge devices like routers.
• Review web server access logs for requests matching the patterns described in the Sigma rule and any associated IOCs from the references.